APT – Telegram

137 viewsPaul Shmidt, 13:00

Got a S3 bucket but don't know who is the owner?

Use the below command to check the bucket owner

aws s3api get-bucket-acl --bucket bucket-name

#bugbountytip #bugbountytips #infosec #AWS

136 viewsPaul Shmidt, 16:33

APT

#BurpHacksForBounties - Day 7/30

Macro: A recorded session in Burp Suite

Part 1: What, How & Why?
Part 2: How to use to automate testing?

#infosec #ppsec #bugbounty #bugbountytips #security #burp

134 viewsPaul Shmidt, 12:00

APT

1/n
Macros in Burp suite are set of recorded requests.

You create that recorded requests by passing request/(s) through proxy first and then selecting set of requests to add to a Macro.

To create a Macro: Project Options -> Sessions -> Macro

129 viewsPaul Shmidt, 12:01

APT

2/n
Click Add and proxy tab will open.

Send the requests you want to record.
Click OK.
Macro will be recorded give it a fancy name.

126 viewsPaul Shmidt, 12:02

APT

3/n
Use Macro with sessions.

For all in-scope URLs now, this macro under sessions will run prior to each request.

143 viewsPaul Shmidt, 12:03

APT

n/n
Use cases
- Sites having custom login.
- Useful in writing extender plugins.
- IDOR testing.

Tomorrow we will see how we can automate testing with Macro and burp.

142 viewsPaul Shmidt, 12:04

APT

#BurpHacksForBounties - Day 8/30

Burp Suite Automation through Macros and Using macros in creating sessions for APIs and protected resources.

#infosec #appsec #burp #security #bugbountytips #bugbounty

139 viewsPaul Shmidt, 04:00

APT

Create Macros for burp as discussed in previous tweet.
#BurpHacksForBounties - Day 7

Once created, add it as session and set the scope. For demo, I am adding all URLs as Scope.

Now all the requests mentioned in Tools scope will be Macro processed.

Use Tracer to debug macro

136 viewsPaul Shmidt, 04:01

APT

🚨🚨🤓 #BurpHacksForBounties - Day 9/30

Following parameter in Burp Suite repeater's response.

A time-saver tip that I read from @sw33tLie reply in the thread by @codingo_

👇🔽⬇️
#security #appsec #burp #bugbountytips #bugbountytip

134 viewsPaul Shmidt, 01:00

APT

When you are playing with a parameter in the repeater tab and its value gets reflected in the response, you can enable this toggle when you have to scroll to see what has changed...a true time-saver!

How to? See the image below.

142 viewsPaul Shmidt, 01:01

APT

Proxying Edge for Burp Suite without interfering with your system proxy settings.

#bugbountytips

❤‍🔥1

144 viewsPaul Shmidt, edited 09:58

APT

Zero-day / CVE-2021-35211

SolarWinds 2.0: Serv-U Remote Memory Escape Vulnerability. The said vulnerability was reported to SolarWinds by Microsoft security team and is under active exploitation.

This security vulnerability only affects Serv-U Managed File Transfer and Serv-U Secure FTP and does not affect any other SolarWinds or N-able (formerly SolarWinds MSP) products.

https://www.solarwinds.com/trust-center/security-advisories/cve-2021-35211

161 viewsPaul Shmidt, 10:48

APT